Abyss-Data
Compare
Parsing: enabled
Description
Abyss‑Data, also known as Abyss Locker, is a ransomware operation first identified around March 2023. It conducts double extortion by exfiltrating data and encrypting systems—particularly targeting VMware ESXi virtual environments—then threatening to leak stolen data via a TOR-based leak site if ransom demands aren't met. The group’s Linux variant derives from the Babuk ransomware source code with encryption resembling HelloKitty, using ChaCha–based ciphers. On Windows, Abyss Locker encrypts files (typically appending “.abyss” or randomized extensions), deletes Volume Shadow Copies, manipulates boot policy to disable recovery, and delivers ransom notes (e.g., WhatHappened.txt), often replacing the desktop wallpaper as part of its extortion tactics. Its campaigns have targeted diverse industries—finance, healthcare, manufacturing, technology—across multiple regions, with victim lists prominently featuring organizations in North America.
External Analysis5
| External Analysis |
|---|
| https://blackpointcyber.com/wp-content/uploads/2024/12/Abyss.pdf |
| https://www.fortinet.com/blog/threat-research/ransomware-roundup-abyss-locker |
| https://www.sentinelone.com/anthology/abyss-locker |
| https://socradar.io/dark-web-profile-abyss-ransomware |
| https://www.ransomware.live/group/abyss |
Tox1
| Tox |
|---|
| 01D33073173C72E543DDCD6895EAE05A57CFDF7B7D906FB99FCD0F26C335290050EA900F8FDA |
Urls1
| Url | ||||
|---|---|---|---|---|
| http://3ev4metjirohtdpshsqlkrqcmxq6zu3d7obrdhglpy5jpbr7whmlfgqd.onion | Down |
|
File servers44
| Url | ||||
|---|---|---|---|---|
| http://ufvi7hpcawesdklmommeeq4iokhq2km4hay3dwh4rirth5xaomle35id.onion/ | Down |
|
||
| http://t7ogwvu74a6flssns55yv7zw2xvssqbhrdbxqrwbahumyzwklnvqayid.onion/ | Down |
|
||
| http://gmxnejtsg3uiwopmnsooxbi3p2nukwemkvm7bg44tgbbnuuuyofqjfyd.onion/ | Down |
|
||
| http://jtjz6utbmabwcatyomwxaeum7ey7nxs7yooqflxhctnksjqsnammonqd.onion/ | Down |
|
||
| http://2mhkqjcw4auxop7auchz2iijcbj63qccwodtokofbb2ul5oejkkt6xyd.onion/ | Down |
|
||
| http://wka7ma7rzgmzmtn65dhv5zp5p6e3uv5sydnns7xsf6kpf7noukhchhqd.onion/ | Down |
|
||
| http://l3yeoyhnphtymqua5env7qitedmqv5ahe7waxgndwa64z2c2h3cjjhqd.onion/ | Down |
|
||
| http://2j45tydxcvm44jbyr6krhx77rzey3jtif5qdjak2gik4usoljvvhqaid.onion/ | Down |
|
||
| http://cuft7z2xlfogrtx4ddqnjqyerye2qtagksow2fip4xbb5iw7dsgtvhqd.onion/ | Down |
|
||
| http://wyz32kscr2ythqpyjwqfxcaxn5576fdurr7jag44gggnmi4cvhykhvid.onion/ | Down |
|
||
| http://3pb6cefz6hubgyb2ph7ua7yjzjpxwapbbp5zomz7xmvrjhjfykjwu6id.onion/ | Down |
|
||
| http://kn4spxunete4ddz7375i2wpnj4vvkir7wdmcg2pc5yod56lmb54nbayd.onion/ | Down |
|
||
| http://2ikvareyuw2wjnc4vb5yteq7d2tkg6k3gevnixzqtkn3cpvej6ajj4yd.onion/ | Down |
|
||
| http://wflff64dxxqvfhd7poarkvkphmibdjyyhv7h4zqo5m52ggsgncmbrbqd.onion/ | Down |
|
||
| http://frheu6drsqpehmuyrdxdrfu5bzqwxps4zlmnuxlcnxskwxcwqsyhwxyd.onion/ | Down |
|
||
| http://kceqbaoxmx2czutxty3mq35m5mv46dq66hpszrhbhduj7uwhu6ax3qad.onion/ | Down |
|
||
| http://4nsmlpz4qceow7bfrmarxdqaj7chcqobin3mzb27uhscb2yvjs6j4xqd.onion/ | Down |
|
||
| http://nka6xgyyu77ksb5xmmovp4en2hrkg53mfq2osql526oe7nybnlggfgid.onion/ | Down |
|
||
| http://mflnjnwfinorxxsgkyfel3fqanbtbbrl5k5mqqjwmrf7o3jc6a4hy3id.onion/ | Down |
|
||
| http://jtt4lqatjtrj5hxxi33dczkluouf5wivzdmy4v62dnhipk6ixk5mktad.onion/ | Down |
|
||
| http://udugclljnfcx34amtpddkjggmkfqci5xnlfef2hqtxstufulo3pvauid.onion/ | Down |
|
||
| http://vmmefm7ktazj2bwtmy46o3wxhk42tctasyyqv6ymuzlivszteyhkkyad.onion/ | Down |
|
||
| http://cfev2mvlqooohl3af2upkgu3ju4qcgqrrgh6sprfxkgh3qldh2ykxzyd.onion/ | Down |
|
||
| http://2fzahjlleflpcyecd245xe3q6tczjkwzcm4fbhd4q4bsun45y2csyayd.onion/ | Down |
|
||
| http://wpefgvpyuszr4vg444qed734big233itylqclte7usszbdbfyqvb2lqd.onion/ | Down |
|
||
| http://gvzbeu532wwxqze3v3xcxpsbhpvwusnajzahi55dqklbunzgjp5wchad.onion/ | Down |
|
||
| http://ieelfdk3qr6as2u5cx3kfo57pdu6s77lis3lafg5lx5ljqf2izial6ad.onion/ | Down |
|
||
| http://yuhflx7yjk52jedcrtb3ne235mmykqfwc6jarby7lxxgv26ep7x4qjqd.onion/ | Down |
|
||
| http://zngbsq66uwem4qzyxpqb5rjo2xebnbwdku27nhmquryx6ljnbbedhiad.onion/ | Down |
|
||
| http://ub63kcmphxbm3m64wwhuznbxfap4hlgqtauhnf4rvz23cdnrqr4towid.onion/ | Down |
|
||
| http://s5v5hvtk3oyxg3m6afgxeuwlasqku3adeosv7kwwjfvhf22vqiwotrqd.onion/ | Down |
|
||
| http://bgifgvekggqjfqx6x45e24vq7nm6in54rk36fo6jg4qf3yvy6lfisgid.onion/ | Down |
|
||
| http://yehbrr7tnzrcpcq2fglrf73ug2jqhgngxnyv3clyhrswdwmg45p7fyad.onion | Up |
|
||
| http://46vfmzfh3uxc3ojn6z267jmiytfhxzq4x7vvnqtycu5wa6hh3jl2hjyd.onion/ | Down |
|
||
| http://tycacxbqdhohowofueufbnekscyomymoxbr4wlim5cqpfv72z6popcid.onion/ | Down |
|
||
| http://y7fupmz3lx64ilnyvxbu73xigzdtc6fl2aee2duuf546duoo4nurv2id.onion/ | Up |
|
||
| http://7lpodmzejui2scqfojx3voadc7fgrt2igww6ipjtnztfg6hprnmel5yd.onion/ | Down |
|
||
| http://toczr6bmtfbgardwgcgbeqntumkxi3y2tsfbcstybf6xknd6cm6e32ad.onion/ | Down |
|
||
| http://euujzkwziy777bg4oyiks2x3s5cxlydao6jhpilzdjmjohja3s4v7jid.onion/ | Down |
|
||
| http://vnsggttwhcofyeh3nxoynxtg5mk5xl4cd7e3c4x62aqb2rj4rfjh3eqd.onion/ | Up |
|
||
| http://ah73jnvhuoznb4n3srbtspsgrdyyde2xszywcjryjroz4wixhwmdrjad.onion/ | Up |
|
||
| http://l7f3ny5yedcm7zhgxzy34mihk6jvgwg7m6qj3cqw4nvky7xv5wttegyd.onion/ | Down |
|
||
| http://gzpjpapbvqcom6yrjnijfyzspfb7oyqt5xni4uxapwfsddw4n4v5wqyd.onion/ | Up |
|
||
| http://co57gakeanqglrzvpyt2lltalirl3y522hyjxah3aqv4pidlzwdhzwid.onion/ | Down |
|
Chat servers1
| Url | ||||
|---|---|---|---|---|
| http://jqlcrn2fsfvxlngdq53rqyrwtwfrulup74xyle54bsvo3l2kgpeeijid.onion/ | Down |
Activity (interactive) 85
Posts85
| Date | Title | Description | Screen |
|---|---|---|---|
| optimumdesign.com | optimumdesign.com 795Gb uncompressed data | ||
| moinian.com | moinian.com 4.7Tb uncompressed data | ||
| hptc.org | hptc.org 1.8Tb uncompressed data | ||
| crownlaboratories.com | crownlaboratories.com 8Tb uncompressed data | ||
| entandallergy.com | entandallergy.com 139Gb uncompressed data | ||
| mdm-insurance.com | mdm-insurance.com 2Tb uncompressed data | ||
| ceratec.com | ceratec.com 700Gb uncompressed data | ||
| halex.com | halex.com 39Gb uncompressed data | ||
| Four Eye Clinics | 313Gb uncompressed data | ||
| jpcgroupinc.com | jpcgroupinc.com 178Gb uncompressed data | ||
| envirosep.com | envirosep.com 304Gb uncompressed data | ||
| kingpower.com | kingpower.com 1.2Tb uncompressed data | ||
| berkotfoods.com | berkotfoods.comt 968Gb uncompressed data | ||
| bataviacontainer.com | bataviacontainer.com 506Gb uncompressed data | ||
| pez.com | pez.com 1.1Tb uncompressed data | ||
| glts.net | glts.net 1.1Tb uncompressed data | ||
| projektalp.ch | projektalp.ch 120Gb uncompressed data | ||
| anhf.org.auh | anhf.org.au 1.5Tb uncompressed data | ||
| In the depths of software development. Unlocking the secrets of Promise Technology, Inc. | Today we publish the first part from a major leak at Promise Technology, Inc. | ||
| promise.com | promise.com 1.8Tb uncompressed data | ||
| victrongroup.com | victrongroup.com 2.3Tb uncompressed data | ||
| tolsa.com | tolsa.com 5.1Tb uncompressed data | ||
| f-t.com | f-t.com 8.4Tb uncompressed data | ||
| tims.com | tims.com 680Gb uncompressed data | ||
| ecbawm.com | ecbawm.com 246Gb uncompressed data | ||
| pfsbrands.com | pfsbrands.com 1.3Tb uncompressed data | ||
| comtruck.ca | comtruck.ca 1Tb uncompressed data | ||
| idahopacific.com | idahopacific.com 3.5Tb uncompressed data | ||
| spvmhc.org | spvmhc.org 15Gb uncompressed data | ||
| robertshvac.com | robertshvac.com 240Gb uncompressed data | ||
| q-cells.de | q-cells.de 5.4Tb uncompressed data | ||
| zoppo.com | zoppo.com 233Gb uncompressed data | ||
| crimsonwinegroup.com | crimsonwinegroup.com.com 1.6Tb uncompressed data | ||
| greenlightbiosciences.com | greenlightbiosciences.com 726Gb uncompressed data | ||
| landmarklife.com | landmarklife.com 2.4Tb uncompressed data | ||
| conferenceusa.com | conferenceusa.com 1Tb uncompressed data | ||
| tpocc.org | tpocc.org 570Gb uncompressed data | ||
| malca-amit.com | malca-amit.com 30Gb + VMware images CHKC-NGSQL.MAFE.COM HKG-TSPLS.MAFE.COM 1.2Tb | ||
| woldae.com | woldae.com 9.7Tb uncompressed data | ||
| rangam.com | rangam.com 1.1Tb uncompressed data | ||
| rameywine.com | rameywine.com 61Gb uncompressed data | ||
| lindquistinsurance.com | lindquistinsurance.com 12Gb uncompressed data | ||
| iamdesign.com | iamdesign.com 78Gb uncompressed data | ||
| yarco.com | yarco.com 1.9Tb uncompressed data | ||
| neigc.com | neigc.com 2.9Tb uncompressed data | ||
| sunharbormanor.com | sunharbormanor.com 91Gb uncompressed data | ||
| vanwingerden.com | vanwingerden.com 337Gb uncompressed data | ||
| mranet.org | mranet.org 3Tb uncompressed data | ||
| posen.com | Posen Architects 724Gb uncompressed data | ||
| transaxle.com | transaxle.com 795Gb uncompressed data | ||
| deltron.com | deltron.com 8.9Gb uncompressed data | ||
| vidalung.ai | vidalung.ai 1.7Tb uncompressed data | ||
| synergyfinancialgrp.com | Synergy Financial Group 97Gb uncompressed data | ||
| micrometals.com | Micrometals, Inc. 997Gb uncompressed data | ||
| concertus.co.uk | Concertus Design and Property Consultants 1,9Tb uncompressed data | ||
| aurobindousa.com | Aurobindo 3,7Tb uncompressed data | ||
| shawneemilling.com | Shawnee Mills 805Gb uncompressed data | ||
| motordepot.co.uk | Motor Depot 636Gb uncompressed data | ||
| lathamcenters.org | lathamcenters.org 75Gb uncompressed data | ||
| apexga.bank | apexga.bank 5 VMware VM from Production Servers | ||
| njsba.com | NJSBA , 529Gb uncompressed data | ||
| www.northriverco.com | North River Co LLC, 303Gb uncompressed data | ||
| www.lasaterandmartin.com | Lasater & Martin, P.C. Attorneys, 697Gb uncompressed data | ||
| www.finitia.net | finitia ag, 465Gb uncompressed data | ||
| plbint.com | PLB International, 990Gb uncompressed data | ||
| www.brockhouse.co.uk | Brockhouse Group Ltd, 35Gb uncompressed data | ||
| www.tractrad.com | Tractrad.com, 35Gb uncompressed data | ||
| www.stri.se | STRI, 189Gb uncompressed data | ||
| www.arb.ch | arb Architekten AG, 220Gb uncompressed data | ||
| www.l3harris.com | 17 VM from wsots.net (Wideband Satellite Communications Operations and Technical Support) | ||
| wsots.net | 17 VM from wsots.net (Wideband Satellite Communications Operations and Technical Support) | ||
| pwlawfirm.com | Piasecki & Whitelaw, LLC 385G uncompressed data | ||
| brett-robinson.com | Brett-Robinson, 393Gb database backups and data from production servers | ||
| avidxchange.com | AvidXchange, Inc All database backups from production servers | ||
| pandol.com | Pandol Bros., Inc 389Gb uncompressed data | ||
| 7x7oralsurgery.com | 7x7 Dental Implant & Oral Surgery 114Gb uncompressed data | ||
| bienvilleortho.com | bienvilleortho.com 147Gb uncompressed data | ||
| largest provider of orthopedic care | 147Gb uncompressed data | ||
| largest provider of orthopaedic care | 147Gb uncompressed data | ||
| A large company | 223Gb uncompressed data | ||
| hosemanufacturing.com | Ratermann Manufacturing 113Gb uncompressed data | ||
| igadiltd.com | IgadI 84Gb uncompressed data | ||
| jones-hamilton.com | Jones-Hamilton Co. 230Gb uncompressed data | ||
| stonehillcontracting.com | Stone Hill Contracting, Inc. 176Gb uncompressed data | ||
| siebold.com | The Siebold Company, Inc. 700Gb uncompressed data |